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Top Stories 

• An air traffic control facility in Aurora, Illinois, is expected to be restored to full service by 
October 13 following a September 26 fire that prompted the cancelation of about 3,800 
flights across the U.S. between September 26 and September 28. - Reuters (See item 10 ) 

• A water-boil alert in Mercer Island, Washington, was lifted September 29 after E. coli was 
detected in water samples from the city’s distribution system September 26 which 
prompted the closure of area schools and 62 businesses. - Seattle Times (See item 21 ) 

• An accident involving a North Central Texas College bus left 4 students dead and 12 others 
injured when the bus was hit by a semi-truck on Interstate 35 in Oklahoma September 26. - 
CNN (See item 27 ) 

• Signature Systems reported September 26 that the breach of its point-of-sales system may 
have compromised the systems of an additional 108 independent restaurants across the 
U.S. that utilizes its payment products. - IDG News Service (See item 38 ) 
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Energy Sector 



1. September 29, KSAT 12 San Antonio - (Texas) Exxon Mobil claims responsibility for 
Marion oil leak. Exxon Mobil is investigating September 29 after an unknown amount 
of oil leaked from its pipeline in Marion, Texas, September 24, forcing the pipeline to 
shut down indefinitely. Crews installed booms to keep the oil from entering a tributary 
that feeds into the Santa Clara Creek. 

Source: http://www.ksat.com/content/pns/ksat/news/2014/09/28/exxon-mobil-claims- 
responsibilitv-for-marion-oil-leak0.html 

2. September 29, Rock Hill Herald - (New Mexico) EPA approves revised state plan 
for PNM’s San Juan Generating Station. The U.S. Environmental Protection Agency 
approved September 26 a revised State plan presented by PNM Resources detailing the 
closure of two of four units at the San Juan Generating Station in New Mexico. The 
plan will bring the coal-fired power plant in compliance with federal environmental 
rules by reducing water use and emissions at the plant. 

Source: http://www.heraldonline.com/2014/09/29/6368565 epa-approves-revised- 
state-plan.html 

3. September 28, Arizona Republic - (Arizona) Thousands without power as storms 
slams Phoenix. About 77,000 utility customers in Arizona lost power while flights 
were delayed at Phoenix Sky Harbor International Airport and several roadways 
flooded due to a storm that dumped several inches of rain in the area September 27. A 
music festival at Tempe Beach Park was cancelled and over 100 people were stranded 
at Dead Horse Ranch State Park. 

Source: http://www.usatodav.com/story/news/nation/2014/09/27/thousands-without- 
power-as-storm-slams-phoenix/16351007/ 

4. September 26, Chicago Sun-Times - (Illinois) Cicero company ordered to clean up 
oil spills near canal. Olympic Oil Ltd., was issued a court order September 26 to clean 
up contaminated soil and groundwater near the Chicago Sanitary and Ship Canal after a 
series of oil spills from the company’s Cicero facility beginning in July. The company 
is required to submit new soil and water samples and prevent future overflows from 
contaminating the surrounding area. 

Source: http://www.mvfoxchicago.com/storv/26639535/cicero-cornpany-ordered-to- 
clean-up-oil-spills-near-canal 

For another story, see item 15 



[ Return to top ] 

Chemical Industry Sector 

See item 14 
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Nuclear Reactors, Materials, and Waste Sector 



Nothing to report 



[ Return to top ] 

Critical Manufacturing Sector 

5. September 29, WESH 2 Daytona Beach - (Florida) FD: Worker seriously injured in 
manufacturing plant explosion. Authorities are investigating after a piece of 
machinery exploded at the LRM Industries International, Inc. facility in Rockledge 
September 29, leaving one worker injured. A fire that was sparked by the explosion 
was quickly extinguished. 

Source: http://www.wesh.com/news/fd-worker-seriouslv-injured-in-manufacturing- 
plant-explosion/283 12842 

6. September 28, CNN Money - (National) Harley-Davidson recalls all 2014 Touring 
motorcycles. Harley-Davidson issued a recall during the week of September 22 for 
about 126,000 model year 2014 Touring motorcycles, including three-wheeled trikes 
and custom-designed bikes, due to the possibility that the bikes’ hydraulic clutch may 
not disengage and cause the bike to crash or tip over. Nineteen accidents, several of 
which occurred during the company’s safety testing, have been linked to the issue. 
Source: http://monev.cnn.com/2014/09/28/autos/harley-davidson-recall/ 

7. September 26, Automotive News - (International) Ford recalls 850,000 vehicles for 
glitch affecting airbags, seat belts. Ford Motor Co., recalled 850,050 model year 2013 
and 2014 Ford C-Max, Fusion, Escape, and Lincoln MKZ vehicles due to an electrical 
problem that could cause the vehicles’ restraints-control module to short circuit and 
cause the airbags and seat belt pretensioners to malfunction in the event of a crash. 

Ford reported that 746,842 of the vehicles were recalled in the U.S. and territories and 
82,962 were recalled in Canada. 

Source: http://www.autonews.com/article/20140926/QEMll/140929907/ford-recalls- 
850000- vehicles-for-glitch-affecting-airbags-seat-belts 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

8. September 26, Softpedia - (International) Dyre banking trojan delivered via voice 
message email notification. Researchers discovered that the Dyre (Dyreza) banking 
trojan is being employed via phishing emails claiming to be from financial institutions 
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and bogus emails purporting to inform of a new voicemail message which include a 
link to a malware dropper that has five Romanian Portable Executable (PE) resources 
and downloads a variant of the trojan. The malware relies on the man in the middle 
(MitM) technique to take over the connection between the client and the server. 

Source: http://news.softpedia.com/news/Dvre-Banking-Troian-Delivered-Via-Voice- 
Message-Email-Notification-460162.shtml 

9. September 25, CNN Money - (National) U.S. Bank refunding $48 million to 
customers. The Consumer Financial Protection Bureau ordered U.S. Bank September 
25 to refund $48 million to consumers and pay $9 million in penalties to resolve 
allegations that the bank charged about 420,000 customers for fraudulent credit card 
add-on products and services that were not provided between 2004 and 2012. 

Source: http://monev.cnn.com/2014/09/25/pf/u-s-bank-refund/ 

[ Return to top ] 

Transportation Systems Sector 

10. September 28, Reuters - (Illinois) FAA wants to restore Chicago air traffic site by 
mid-October. Federal Aviation Administration officials reported September 28 that a 
regional air traffic control facility in Aurora, is expected to be restored to full service 
by October 13 after crews complete repairs and replace the central communications 
network in the building following a fire that was intentionally set by a field technician 
September 26. An estimated 3,800 flights were canceled across the U.S. between 
September 26 and September 28 as a result of the incident. 

Source: http://news.vahoo.com/faa-wants-restore-chicago-air-traffic-mid-october- 
001045762— finance.html 

11. September 28, WOWK 13 Charleston - (West Virginia) 1-64 in eastbound at the St. 
Albans exit reopened after accident shut down part of interstate. Eastbound lanes 
of Interstate 64 at the St. Albans exit in Putnam County reopened after closing for more 
than 2 hours September 28 due to a collision involving a semi-truck and a vehicle. 
Source: http://www.wowktv.com/story/26647957/i-64-eastbound-shut-down-after- 
truck-carrying-grain-collides-with-car 

12. September 26, Associated Press - (Massachusetts) 5 Boston airline workers accused 
of smuggling cash. Four JetBlue Airways employees and one Delta Air Lines customer 
service ramp agent were charged with using their security clearances to sneak more 
than $417,000 in cash past Transportation Security Administration checkpoints at 
Boston Logan International Airport from open areas of the airport, including public 
bathrooms and passenger drop-off areas. The money is beheved to be connected to 
illegal drug sales. 

Source: http://news.msn.com/crime-iustice/5-boston-airline-workers-accused-of- 
smuggling-cash 

13. September 26, Associated Press - (New York) NY mail carrier accused of hoarding 
40,000 letters. A New York City postal worker was arrested September 24 for 
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allegedly failing to deliver more than 40,000 pieces of mail to businesses and homes in 
the Brooklyn area of New York City since 2005 and storing the mail at his home, car, 
and post office-issued locker. 

Source: http://news.msn.corn/crime-iustice/nv-mail-carrier-accused-of-hoarding-40000- 
letters 



14. September 26, Amarillo Globe-News - (Texas) Chemical spill shuts down 1-40. 
Westbound lanes of Interstate 40 near Amarillo were closed for more than 5 hours 
September 26 while crews worked to identify and contain a sodium tolyltriazole spill 
that was leaking from a commercial HAZMAT transloader semi-truck onto the 
roadway. 

Source: http://amarillo.com/news/local-news/2014-09-26/traffic-avoid-westbound-i40- 
near-georgia 

15. September 26, WIVB 4 Buffalo; Associated Press - (New York) State, fed agencies 
again find defects on oil trains. A report issued by the governor of New York 
September 26 found 72 minor defects and one critical defect from a split rail after an 
inspection of 766 tanks cars and 167 miles of track in New York. The inspection 
program began in February after several accidents across the U.S. and Canada and 
defines that non-critical defects must be fixed before the train departs the yard. 

Source: http://wivb.com/2014/09/26/state-fed-agencies-again-find-defects-on-oil-trains/ 

For another story, see item 3 
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Food and Agriculture Sector 

16. September 27, U.S. Department of Agriculture - (New Mexico) New Mexico firm 
recalls beef jerky products incorrectly produced and shipped with the mark of 
inspection. The Food Safety and Inspection Service announced September 27 that 
Delicious Beef Jerky, LLC, issued a recall for 8 pounds of its Lemon Pepper Seasoned 
Beef Jerky products because they were incorrectly shipped with the mark of inspection 
without the benefit of inspection. The products were packaged in 2.5- and 5-ounce 
plastic bags and were sold in retail store in the Albuquerque area. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/2014/recall-062-20 14-release 

17. September 26, U.S. Food and Drug Administration - (Massachusetts) Whole Foods 
Market Bedford recalls streusel coffee cake due to undeclared tree nut allergen. 
The U.S. Food and Drug Administration announced September 26 that Whole Foods 
Market issued a recall for its Plain Streusel Coffeecake that was produced and sold at 
its Bedford store between September 19 and September 25 due to undeclared pecans. 
Source: http://www.fda.gov/Safety/Recalls/ucm416446.htm 

18. September 26, U.S. Food and Drug Administration - (Oregon; Washington) 

Dominguez Foods of Washington Inc. issues allergy alert on undeclared wheat, 
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whey (milk), and soy in “Su Cocina” label, pan molido (plain bread crumbs). The 

U.S. Food and Drug Administration announced September 26 that Dominguez Foods of 
Washington Inc., issued a recall for 8-ounce packages of its Su Cocina pan molido 
(plain bread crumbs) due to undeclared wheat, whey (milk), and soy caused by 
mislabeling. The product was distributed to two retail stores in Oregon and two retail 
stores in Washington. 

Source: http ://w w w .fda. go v/Safet y/Recalls/ucm4 1 6426 .htm 

19. September 25, Food Poisoning Bulletin - (National) Live poultry Salmonella 
outbreak sickens 344 in 42 States. The U.S. Centers for Disease Control and 
Prevention reported an additional 44 cases related to an ongoing Salmonella outbreak 
linked to live poultry from Mt. Healthy Hatcheries in Ohio, bringing the total case 
count to 344. Sicknesses related to the outbreak have onset of illness dates ranging 
from February 3 to August 23 and span across 42 States and Puerto Rico. 

Source: http://foodpoisoningbulletin.com/2014/live-poultrv-salmonella-outbreak- 
sickens-344-in-42-states/ 



20. September 25, Food Safety News - (Maryland) Report: Chicken on menu at 2014 
Food Safety Summit was contaminated. The Maryland Department of Health and 
Mental Hygiene released a report September 25 stating that a chicken dish prepared and 
served at the 2014 Food Safety Summit by Centerplate, the Baltimore Convention 
Center’s exclusive caterer, was likely contaminated with Clostridium perfringens (C. 
perfringens) and was the likely source of an outbreak that sickened 216 attendees at the 
April 9 conference. 

Source: http://www.foodsafetvnews.com/2014/09/c-perfringens-in-c 
For another story, see item 21 
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Water and Wastewater Systems Sector 

21. September 29, Seattle Times - (Washington) Mercer Island lifts water-boil alert 
Monday morning; schools closed. Officials lifted a water-boil alert in Mercer Island 
September 29 and advised residents to flush pipes and clear ice makers after water 
samples tested negative for E. coli following detection of the bacteria in water samples 
from the city’s distribution system September 26. Mercer Island School district was 
closed September 29 to sanitize the schools’ facilities and 62 businesses were ordered 
closed until the boil-water advisory was lifted. 

Source: http://blogs.seattletimes.com/todav/2014/09/tests-improve-but-water-boil-alert- 
remains-for-mercer-island/ 

22. September 29, KCAL 9 Los Angeles/KCBS 2 Los Angeles - (California) Delays 
expected as crews continue to repair 2 water main breaks along Sunset Blvd. A 36- 
inch water main ruptured September 26 and gushed 9,600 gallons of water onto the 
road per minute prompting the closure of a portion of Sunset Boulevard in West 
Hollywood until September 30. Crews patched the line after about 6 hours, and worked 
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to complete repairs to an unrelated break in the area September 29. 

Source: http://losangeles.cbslocal.com/2014/09/29/delavs-expected-as-crews-continue- 
to-repairs-2-water-main-breaks-along-sunset-blvd/ 

23. September 26, WNYT 13 Albany - (New York) DEC confirms 13,000 gallons of 
sewage spilled into Lake George. The New York State Department of Environmental 
Conservation is investigating after the Sagamore Hotel-operated private sewer system 
overflowed and released about 13,000 gallons of waste into Lake George September 
24. Approximately 5,000 gallons of sewage was collected by a waste hauler while an 
additional 1,000 gallons were diverted to a grassy area. 

Source: http://wnvt.com/article/stories/S3572718.shtml 

24. September 26, WGCL 46 Atlanta - (Georgia) Car crashes into Atlanta water 
treatment basin. The driver of a vehicle lost control and drove through a fence and 
into a mixing basin holding untreated water from the Chattahoochee River at an Atlanta 
water treatment facility September 26 prompting workers to shut off the valve from the 
basin and drain it for inspection, during which they found one of the walls was in need 
of repair. Authorities reported that operations were not impacted by the incident and the 
water supply will not be affected. 

Source: http://www.cbs46.com/storv/26633908/car-drives-into-atlanta-water-treatment 
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Healthcare and Public Health Sector 



25. September 29, Birmingham Business Journal - (Georgia) American Family Care 
alerts customers of stolen laptops containing patient information. Birmingham, 
Alabama-based American Family Care announced that two laptops containing the 
personal and health information of an undisclosed amount of patients were stolen from 
an employee’s vehicle in Marietta, Georgia, during the summer. 

Source: http://www.biziournals.com/birmingham/morning call/20 14/09/american- 
familv-care-alerts-customers-of-stolen.html 
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Government Facilities Sector 

26. September 28, WOFL 35 Orlando - (Florida) Students return to school after 
Seminole Co. hoax bomb threats. Classes resumed September 29 in Seminole County 
after eight elementary schools were evacuated September 26 when the sheriffs office 
received a hoax threat claiming there were bombs at three elementary schools. 
Authorities are still searching for the suspect and the school district worked to update 
their notification system. 

Source: http://www.mvfoxoiiando.com/storv/26649007/students-retum-to-school-after- 
seminole-co-hoax -bomb-threats 

27. September 27, CNN - (Oklahoma) 4 killed when semi hits bus carrying Texas 
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college softball team in Oklahoma. An accident involving a North Central Texas 
College bus left 4 students dead and 12 others injured when the bus was hit by a semi- 
truck on Interstate 35 in Oklahoma September 26. 

Source: http://www.cnn.com/2014/09/27/us/oklahoma-school-bus-accident/ 

28. September 25, Associated Press - (Alaska) 21 Alaska soldiers exposed to carbon 
monoxide. The U.S. Army is investigating after 21 soldiers were evaluated and treated 
after being exposed to carbon monoxide during a field training exercise at the Yukon 
Training Area near Eielson Air Force Base in Alaska September 25. 

Source: http://abcnews.go.com/US/wireStory/21-alaska-soldiers-exposed-carbon- 
monoxide-25768788 



For additional stories, see items 3 and 21 
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Emergency Services Sector 

29. September 28, Reuters - (Tennessee) Police catch last of 13 boys who escaped from 
Tennessee detention center. Police recaptured the last of 13 boys September 28 who 
escaped from the Woodland Hills Youth Development Center in Nashville September 
26 after one of the boys got inside an unoccupied guard shack and activated the gate 
releasing the others. Authorities recaptured the 12 other boys within hours after their 
escape after they overpowered a guard and took his keys and radio. 

Source: http://news.msn.com/crime-iustice/police-catch-last-of-13-boys-who-escaped- 
from-tennessee-detention-center 
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Information Technology Sector 

30. September 29, Softpedia - (International) New remote code execution flaws found in 
Shellshock-patched Bash. Researchers found four additional vulnerabilities with the 
Bash command interpreter for Finux, Shellshock, two of which were unofficially 
patched after new changes to the code. The two new bugs that remain could be 
exploited remotely and in an easier way due to the rare use of address space layout 
randomization (ASFR) when compiling Bash. 

Source: http://news.softpedia.com/news/New-Remote-Code-Execution-Flaws-Found- 
In-Shellshock-Patched-Bash-460348.shtml 

3 1 . September 29, Softpedia - (International) Elio social network recovers after DDoS 
attack. Administrators with Elio, a social networking site, announced they blocked a 
bad IP address that was responsible for sending junk traffic after reporting the site was 
under an apparent distributed denial of service (DDoS) attack. 

Source: http://news.softpedia.com/news/Ello-Social-Network-Recovers-After-DDoS- 
Attack-4603 24 . shtml 
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32. September 29, Softpedia - (International) Cisco lists 31 products vulnerable to the 
Shellshock vulnerability. Cisco released a list of 3 1 products vulnerable to the 
Shellshock glitch which included connection routing, network management, and media 
content delivery and encoding, among others. Oracle also released a list of 32 products 
vulnerable to attack by the Bash bug after the company changed its initial list and 
appended new products. 

Source: http://news.softpedia.com/news/Cisco-Lists-31-Products-Vulnerable-To-the- 
Shellshock- V ulnerabilit y-460303 . shtml 



33. September 26, SC Magazine - (International) iThemes users asked to change 

passwords following attack. The CEO if iThemes, a WordPress themes, plugins, and 
training provider, advised 60,000 past and current users to reset their passwords 
following an attack on its membership database that may have compromised 
usernames, email addresses, passwords, names, IP addresses, and purchase information. 
Source: http://www.scmagazine.com/ithemes-users-asked-to-change-passwords- 
following-attack/article/373939/ 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

34. September 25, U.S. Department of Labor - (Kansas) Wireless Horizon tower collapse 
results in deaths of 2 cell tower workers. The Occupational Safety and Health 
Administration cited Wireless Horizon, Inc., September 25 for 2 willful and 4 serious 
safety violations and placed the company in the Severe Violator Enforcement Program 
following the March 25 death of 2 workers from the collapse of a cell tower they were 
dismantling in Kansas. Proposed fines total $134,400. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=26781 
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Commercial Facilities Sector 

35. September 29, KTVU 2 Oakland - (California) Explosive package forces Pittsburg 
neighborhood evacuation. A Pittsburg, California apartment building was evacuated 
and surrounding residences were ordered to shelter-in-place September 28 - September 
29 after a package filled with roadflares wrapped with rifle shells was found by 
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cleaning crews inside the apartment unit of a resident who was recently evicted. The 
Walnut Creek bomb squad disabled the explosive device without incident and declared 
the scene safe. 

Source: http://www.ktvu.com/news/news/crime-law/explosive-package-forces- 
pittsburg-neighborhood-ev/nhXpd/ 

36. September 29, Associated Press - (Oklahoma) Oklahoma City office complex 
destroyed in fire. A fire that broke out September 29 at the Wilshire Gardens Office 
Park complex in Oklahoma City left the building a total loss and caused an estimated 
$1 million in damage to at least four businesses, including a printing business and law 
office. The cause of the fire is under investigation. 

Source: http://www.ktul.com/storv/26651698/oklahoma-citv-office-complex- 
destroyed-in-fire 

37. September 28, Reuters - (Florida) Shooting at Miami club leaves 15 hurt, including 
11-year-old: police. Police are investigating a September 28 shooting at The Spot teen 
club in a Miami strip mall that left 15 individuals between the ages of 1 1 and 25 
wounded. Authorities are interviewing witnesses to determine who was responsible for 
the incident. 

Source: http://www.reuters.com/article/2014/09/28/us-usa-miarni-shooting- 
idUSKCN0HN0R320140928 



38. September 26, IDG News Service - (International) Credit card breach that hit Jimmy 
John's is larger than originally thought. Signature Systems reported September 26 
that the breach of its point-of-sales system that affected 216 Jimmy John’s sandwich 
shop locations also may have compromised the systems an additional 108 independent 
restaurants across the U.S. that use its payment products. The intrusion is believed to 
have started June 16 when hackers used stolen credentials to remotely install malware 
onto stores’ payment terminals that is capable of stealing customers’ payment card 
information. 

Source: http://www.networkworld.com/article/2688453/securitv/credit-card-breach- 
that-hit-iimmv-iohns-is-larger-than-originally-thought.html 

39. September 26, USA Today - (Illinois) McDonald's headquarters evacuated after 
scare. More than 1,000 employees were evacuated from the McDonald’s Corp. 
headquarters in Oak Brook September 26 when a worker reported an unidentified 
suspicious package inside the mailroom at the McDonald’s Plaza building. The scene 
was cleared about 2 hours later after a bomb squad determined the package was a 
digital media player. 

Source: http://www.usatodav.com/storv/monev/business/2014/09/26/mcdonalds- 
headquarters-fast-food-evacuation/1 6273297/ 

40. September 26, Associated Press; KNOM 780 AM/96.1 FM Nome - (Alaska) Nome 
apartment fire injures 2, leaves more than 20 people homeless. Two residents were 
injured and more than 20 others were displaced by a September 25 fire that tore 
through an 8-unit apartment building in Nome. Authorities are investigating the cause 
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of the fire and reported that the building is likely a total loss. 

Source: 

http://www.greenfieldreporter.com/view/story/bl264509770a44a08fl3775f82eb598c/ 
AK— Nome- Apartment-Fire 

For additional stories, see items 3 and 21 
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Dams Sector 

41. September 28, Lebanon Valley News - (Vermont) Windsor gets $1 million grant. The 
manager for the town of Windsor announced September 26 that the dam on Kennedy 
Pond in Vermont will receive $995,000 to be used for repairs, which include repairs to 
the stone buttresses and to the dam’s structural integrity. 

Source: http://www.vnews.com/news/13737764-95/windsor-gets-l-million-grant 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
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Contact Information 
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Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 
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